CVE-2025-21662

What it actually does

When cmd_alloc_index() fails inside cmd_work_handler(), the function returns without calling complete() on ent->slotted, leaving the issuing task blocked indefinitely inside wait_for_completion() in cmd_exec().

Why it matters to the business

Systems using mlx5 network hardware may experience prolonged worker-thread blocks, hung-task warnings, and loss of network configuration or telemetry operations under load or resource pressure, increasing downtime risk on affected servers.

How an attack unfolds

An attacker or automated workload that can induce mlx5 command submissions while command-entry allocation is under pressure (for example via resource exhaustion) triggers the early return path, causing kernel worker threads to hang on the uncompleted synchronization object.

How to fix it

Upgrade the Linux kernel to version 6.1.125 or later, or apply commit f0a2808767ac39f64b1d9a0ff865c255073cf3d4. Reboot affected hosts after the update.

How to confirm the fix worked

Confirm the running kernel contains the fix by checking the presence of the completion call before the early return in cmd_work_handler and verify no hung-task traces reference mlx5 command paths after upgrade.

Typical attack path

1. Submit mlx5 commands that exercise cmd_exec path
2. Force cmd_alloc_index failure through concurrent load or memory pressure
3. Omit completion of ent->slotted on early return
4. Block caller indefinitely on wait_for_completion

How to detect it

Search kernel logs for the exact string 'failed to allocate command entry' together with subsequent 'blocked for more than 120 seconds' messages referencing mlx5_core functions or mlx5e_tx_dim_work.

• failed to allocate command entry
• cmd_work_handler
• mlx5e_tx_dim_work
• wait_for_completion+0x28/0x38

What your security team should do

• Apply the kernel update to 6.1.125 or equivalent on all systems exposing mlx5 hardware within the next maintenance window
• Enable hung-task detection logging and monitor for 'failed to allocate command entry' messages
• Review workload patterns that may trigger command allocation failures and add resource-headroom controls